CVE-2026-82451

6.1 Moyenne

Publiée le 29/08/2026 à 16:16 · Modifiée le 23/09/2026 à 19:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.

Traduire en français

Produits concernés

getformwork Formwork

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.1 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/getformwork/formwork/releases/tag/2.3.11
https://github.com/getformwork/formwork/security/advisories/GHSA-hpgc-57cm-66pc
https://www.vulncheck.com/advisories/formwork-stored-xss-via-referer-header

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories